wireshark對PPPOE連接過程抓包分析

1、PPPOE建立過程抓包分析準備工作：1.開啟wireshark，設置過濾條件pppoedorpppoes，點擊apply應用cJ55、申笹彈土回C3Q嘆E岬IE喉応辱NofPFPWdbPRMHJ5|&pr?55icn.les-如日ySw?FiletcaScwwDesisnaticiHPratwcJLhgttiIMtjcuii-j-n丄j-Si-：ue11_7曲；mL11_；九；比冋LLFalerinriseion試K2M.2015-05-14i3.57!lil.m11_27ji7!6cpppoec2Q沖亡工1*uQTarnSnAtfii(pt)2015-09-1413.57：lU.S77S52

2、000_Mil54PPPQE口54Acti*ijQDiEcatMaryftaquest(P4Dft)4M2015-09-1*413:57：23.2ttMS30aDLrall_27:aT:S匚DnH_flZ：S0：PPPaED呦Acti-UQDiscarrySassinn-c口nfinmt*lDri43-12D15-0B-1413:57:23.209512000Dell_-92：3a：SeDen_2T:ir：&cPPPLCP43CaiFIgur-BEdanRequEit+422015-09-1413:57：24.212ZC40aDDell_Z7：a7:fi匚DeH_9Z:30：2ePPPLCPQ

3、DCmfiguricd口口RequEit4432Q15-a9-U13：57；24-212344000Dell_92：3O；徒Dell_27：i?：CcPPPLCPJ7匸口nFlyjf/cHijnAck4512015-CI9-WL3；57；Z5a2a391QKDQell_?2：3C!i兀Dell27:a.rPPPLCP43CHiFigur-acignR-eEfJCJC4543015-03-14-13;7;25.21QHXLM0De11_27:a?:Del1_52-30:5-1!PPLCPCariFigpjr-iticinR-eject4552015-OS-1413;S7;25.ELUMM0Orl

4、l_92i30;5eDenJ27-a7;tcpppLCP托CcrrFigur-iticinRcqweat4542015-09-14-13-5?：35,212521000eiUHi?沌IMll_92nO!5pppLCPcartflgMr-iclOHaxzk4572015-09-1413-57：35.212546(X)0EHll_27：a7：iECDfiTI-M：妙5PP?LCPEcnoRequest2015-09-14-13:57:25.21255000rwil_2?:a?:5cDell_92：30：5pppun.DF68cltalleng-e(riflXE=xnieic-opr1pitx-3K

5、)452015-09-1413：57：25.212074000oeil_92：30:5eMT1-27Ja?：tKpppLCP40iOenriricailwi42015-09-141345?：25a；1296+MO(Mliug出50;扉MT1_274a7:tcpppLCP52idenrincaTliQin4612015-OJ-141357:25,Zli02flWQoeii_23O:5eM1U;7:a?;仇PPPLCF46iOenTirKaHwi46；2015-09-1-4L3-57：25-Z14fl10MQmilfl343d:5emH27-it：6cPPPLCP50EchoRfiDlVF“e47

6、4:百&byreson閔七fiSObfrs),60brescapTiurci480b1is)minrerface0aEthernern,src:oen_2r：ayjfic(tJ8-ac:6f-274a?:c,carsmi1_92-3QDO:SO丸：艸汁琦2.點擊PPPoE寬帶進行連接（至于如何創(chuàng)建連接什么的自己百度去）3連接完成，即可進行抓包分析了。PPPOE建立過程抓包分析一、發(fā)現(xiàn)階段Discovery1.PADI：客戶機以廣播的形式發(fā)送PADI數(shù)據包，請求建立鏈路。lJJMis曲2415mnn1L2B3Q91LZZ2QJiU10!i13i2?O3SWOU10!H3.20375000H10j

7、?C!i3.2?iL3Ml145*.H25ST5JKQM丄口；細54.51*也STTZJTTPTRMllJf!W：F4Mil_VZ:M:mHj!?iir：acir-MCwTTAeiSSiHMlTJ7ia7icM11_?J!D11_2Txa?!4CMll_Z30!MCWWDPfMDPFFdfiDF-FF-MDFF-PiKDEE1iFx-JJi-:it-xg*.afiE.*；j4.J5T*.TlV4PlCffr1di牝Tri1frsnisld?rdDIrjCfSEFi已EilJMLSj./D_LThcrmii.btl;PfeTTjSe：3a；fiekjo豈赳聲世m(xù):t1k1c413erc-adtu

8、t=-_mntrct：mT1_$2;3&i5c(WrFe;9?i34;5t，-一TpIFPPZCD恬磁斕裁F四(町h1nJm1nriwfgrFDucBroMtc-Tit；ri*pr；mFV-Otr-ELnCCOlSCCryMCo.wr1i:t.4(Hl-TyjM-!1壬i:鼻匕43T!CM3Ca.5-M-143d:29jl.2T0jrjMDC5DaoDalT_J7:SBcPIVKbEri.1rii0仏偽vlyCPjMMnKU-4|3E1P1&1-W1E4M.tHAWViryAscuiatMAEEi.-aHiE-Mirrnaiiinc-arrfiruc-itnPFveDPNiDfibn*Tl_7

9、7:*?:BcteH_HZ;M;5eE3S2KB13233C0.5-M-ld：a：Jtf=5d.-aaai?5Mb&10:51U?SfflLJ-B-liW；29；54SE柳Dell_2r；bt；c-斤應溟節(jié)：忖hyscsC*iWip化帕上Wbt邛IW代“5十代QLTher.-iei:II.3T-:wll-Zniir-Sck61ic；：pt!pppkDlico.1l：CTwerj-TbBlnM層H1L.-nr-lin:1.MD1-Typa:1Tod*:占rM”HLenvr*vtiiBr-crrlr!:iehitHi-ionb:axabCG-l-一_命LE網20-MEMWKnSK曰LEEI啣二、會

10、話階段ppp1.協(xié)商階段:客戶機和AC要互相發(fā)送LCPRequest給對方，來確認發(fā)送的最大傳輸單元、是否認證和采用何種認證方式的協(xié)商。(1)確定采用認證方式(2)確定最大傳輸單元2.認證階段：雙方通過LCP確定好認證方式后，就立刻進行認證，認證完成后才可以進行之后的網絡層的協(xié)商。該過程可以抓包到PPPOE撥號的用戶名及加密后的密碼。mE1KU4U1船!5?汐靈HUlMgDTTN=1=5Mli_?7:a7ife:PFLCP刪ilP46EdAXlflClTlCflF-PChaiIH-baHix-id-iikMrthftruVvurVnnPrcal00頑侖可MlHJiAcwfe:wwpan.bei

11、MrtCiT1r:L(ngth：fWj1uSixh:14IwjjItr3.IPCP協(xié)商階段：雙方協(xié)商IP服務階段的一些要求，已決定雙方都能接收的約定。雙方的協(xié)議是通過報文中的Option進行協(xié)商的，每一個Option都是一個需要協(xié)商的問題。則個過程一般協(xié)商多次。最后雙方都需要答復Configure_ACK的同意報文。(1)客戶機同意報文A.AC發(fā)起申請RequestB.客戶機確認，發(fā)起ACK報文(2)AC同意報文(該過程可能需要很多次協(xié)商，下面只列舉失敗和成功各一次):A.客戶機發(fā)起申請RequestPPPEFCPPPPIFVtCP60canfIgurilonR-frqiiASTJ4Cnr*f

12、iguraticnRequest4fi&201S-oa-lq13：S7J2S.216622KCMl1_27:37!住Ml1_W：30.E2015-09-1413:5?-?521i249OMDell_;?0:5eDell？；a7:6c2015-M-ia+7020iS-Oil-14i712015-09-14*T24712Q15-Ofl-144742015-09-ia13;57-27SM3HWBW13：S7j25.21S322DKi13：5?：2521953000013；57-2522240*000i3：57j2S.222721DOO13;57-2722W4BMO4-B32D11-M-14IS：57

13、:25.2M245KC5M2015-O9-1413：57：25.N739f95B22015-09-1313;57：Z?5MK9W0丹占2015-011-145952O15-W-14594JDl-OS-1-460S201S-OQ-1413：57j2S.776iMB13;57-2!613：57:2fl.&MZlKCi3!S7j27.7W705MHDcll_Zr；aTic.Mll_92：30：54!Del127;a7;CcCel1_2?;曠192.1.5.15192-165-5=1519Z1S.5.LJifi2.16fi.S-11i號ltfiBS1J19E.1W.5.Uii2.i6.5.il0e11

14、_2;列；NM11_W：30.EDeiiur?:a7:6cOe11_52;3Qi3Ml1_27!376cOel1_W;3075cJ24.D.0.22255.2$5.55.255Id199.101.LV1PPPppppppPPFPPPPPPLPEPCPIKPEFCPEFCPIFCPPHCP&HSIQPraLLMtLSnfiCHSKPro-tocnlejiect&canfigurilon冏044configurarlanRtquesTWCor*fIguratIanMk44canfigurTlcinRL-tqiitiiSiTKCondfiguratian*ckS2NnvshipRapcrt/lain

15、group224.0.252fara3Wdhcpinfwn-TransicdmmCxd6aio!ngroiip224-0-0.2S2forastandard申eyfirOfS?Ais-itap74ScandardgtwryOxDfarAiitiap俯rcandardouirv01.8414a,t-tr-Ailo.tovfi.inilcrasciTiz.c11Fr-sn-c;5*byesanaire44SbHts)1Mbyxesciptvred(4-iRbits)t*lirrr-e-fct0EihrnTzi,srciDftll_S2a3il:54-byt*Q,ifaiddrsw,pfIbbt”曲

16、耳sarMM*ifAddrass.prlurymumssvaripAddress,sacor-darymsswvaripAddress,s&condjryuhssIP*ddrs;PriraarChSSerrEFAddress:0.D.Q.0EsPTlHiryREN5EPAddrJ0.0-0.0KiSecondaryHi5ServerIPAd-esu0.0.0.n5呼mdsaryimb呼竺“廿ipjddraaa-CLO.DB.AC拒絕RejectC.客戶機重新發(fā)起新的申請RequestD.AC確認，發(fā)送ACK報文4704714724732013-00-142DLS-D9142015-00-142

17、D1.S-D9L42S.219122DDD2S.219S3D0D2S.2224&6D0D2S.22272LDQQDalI_27ia7Dali_32!saDalI_27ia7Dal1_D2!30Ccll_!32!SD：5*C*n_7:a7:&cCcll_!32!SD：54JC*n_7:a7:&cPPPPPPPPPPPPIPCPIMPIPCPIMP4-742D13-D9.4B3：D15-DQ-1J11HlS7：2S.ZMJiSMDE&42fliS-flQ-1413!S7e2S.2aS73S&305B22tiiS-flO-l-+133t5L43&30E&B111S7L25.7fi37&3D0&E-.

18、135.13lgi.iSS.5.13lK2.1fi.5.13C*11_D2!3D:S*FPRIPCP&0ConfiguritianH-aj-iict44CorrfngurAldann.-aqucc&0Canfiguritianhuk44CorrfngurAldann.-aqucc&1CnnfiqLTaticinfek:150dhcpinfcth-irarisactioniaONdfiSri11155TEdndard勺gy口MQaQ4MalFarimAdPa.ck62MAhbcirstiSfRCficrt/jcifrigroup224-0.aa印曰s),60byr-sscapTLrftd。昌Dtiesonintarfsd：DCtharntII,rc:Dall_27：aT!ficbB:!fcf:27!a7:6c?DscjDfil1_52!:5ft(hO!3:f*!D2：3D2Sfl)匚iSiF474:6Dby-asdhh